Domain 2: Network Security Monitoring

GIAC Certified Enterprise Defender · 19 questions

• A Zeek analyst reviews logs and finds repeated DNS queries from an internal host to randomly-generated domain names that all resolve to the same external IP. What attack technique does this MOST likely indicate?
• During PCAP analysis, an analyst observes an internal host sending small, periodic HTTP POST requests to an external IP every 60 seconds. Each request body contains a small amount of base64-encoded data. What does this MOST likely indicate?
• A Suricata IDS rule fires on traffic between two internal hosts. The signature matches a known SMB exploit. The analyst confirms both hosts are fully patched. What should the analyst conclude?
• A security analyst is tuning a Suricata IDS and finds a single rule generating 10,000 alerts per day, all of which are verified legitimate business traffic. What is the BEST approach to reduce alert noise while maintaining detection capability?
• A Zeek conn.log entry shows a connection with a duration over 8 hours, consistent byte counts throughout, and a destination on port 4444. What does this MOST likely indicate?
• During log correlation in a SIEM, an analyst notices: a firewall allows RDP from an external IP, followed 2 minutes later by a Windows Security log showing a successful logon for a service account, followed by execution of PowerShell with encoded commands. What attack phases does this sequence represent?
• A network security analyst identifies a scan pattern where a single external source IP sends TCP SYN packets to sequential destination ports on a single host without ever completing the three-way handshake. What type of scan is this?
• An analyst reviewing Zeek DNS logs finds unusually long DNS query names (200+ characters) being sent to an external nameserver for a domain registered two days ago. What technique does this MOST likely indicate?
• A SOC receives an alert that an internal host is communicating with a known malicious IP. The firewall is blocking the traffic. Which ADDITIONAL action should the SOC take?
• An analyst notices that traffic from the corporate network to a newly registered domain spikes every night at 2 AM in 512-byte intervals lasting 30 minutes. Zeek logs show the connection uses port 53. What is the most likely threat and best immediate analytical step?
• A Suricata rule fires on a connection: alert http $HOMENET any -> $EXTERNALNET any (msg:'ET TROJAN Possible Cobalt Strike Beacon'; content:'|00 00 00 00|'; offset:4; depth:4;). The alert shows the source host is the CFO's laptop. What is the correct next analytical step?
• While analyzing Zeek conn.log entries, an analyst observes thousands of short-duration (< 1 second) connections from one internal host to 254 unique internal IPs on port 445. What does this traffic pattern most likely indicate?
• An analyst is building a Suricata detection rule for a known exploit that sends a specific 8-byte magic value at offset 0 in a TCP payload on port 9001. Which rule syntax correctly captures this?
• A security analyst receives a PCAP file and is asked to determine if data exfiltration occurred over HTTPS to a known-bad IP. SSL/TLS inspection is not available. Which technique provides the most useful intelligence without decrypting the traffic?
• A Zeek http.log entry shows: method=POST, uri=/gate.php, host=update-cdn12.net, requestbodylen=48320, statuscode=200. The domain was registered 3 days ago. What is the most significant indicator of compromise in this log entry?
• An analyst reviews firewall logs and notices that a web server in the DMZ initiated an outbound connection to an external IP on port 4444. The DMZ firewall policy only allows inbound connections to the web server. What does this event most likely indicate, and what log source should be examined next?
• Your organization uses Zeek for NSM. An analyst notices that the files.log shows a PE executable (application/x-dosexec) was downloaded over HTTP from an internal file server to 30 workstations within 5 minutes. What is the most important immediate action?
• An analyst captures a Zeek DNS log entry showing extremely long subdomain labels: '6f626a65637476616c7565.aabbccdd1122.exfil-domain.com'. What does this indicate and what is the recommended analytical step?
• A security architect is evaluating whether to deploy a Network Detection and Response (NDR) solution or expand SIEM capabilities for east-west traffic monitoring in a data center. Which capability uniquely favors the NDR approach?